https://spontaneus.it
top of page

Privacy Policy

Processing of Personal Data and Data Subject Rights

The personal data provided by users will be processed manually and/or by means of electronic systems, in compliance with the principles of fairness, lawfulness, transparency and protection of privacy, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree No. 196/2003 (Personal Data Protection Code), as amended by Legislative Decree No. 101/2018, and other applicable data protection legislation.

Under applicable law, data subjects have the right to obtain confirmation as to whether or not personal data concerning them exist and, where provided for, to access such data and request their rectification, updating, erasure or restriction of processing.

Data subjects may also object to the processing of their personal data on grounds relating to their particular situation, where provided for by law, and may object at any time to processing carried out for direct marketing purposes, including profiling related to such purposes.

Data subjects also have the right to withdraw previously given consent, where processing is based on consent, without affecting the lawfulness of processing carried out before consent was withdrawn.

To exercise their rights, data subjects may contact the Data Controller using the contact details provided in this Privacy Policy.

Data Controller, Categories of Data and Purposes of Processing

The Data Controller is Natural Service, represented by its legal representative pro tempore. The Data Controller's contact details are provided at the bottom of this page.

The categories of personal data collected are those necessary to identify the user and perform the sales contract, including:

  • first and last name;

  • tax identification number, where necessary;

  • billing and/or shipping address;

  • products ordered and related order details;

  • telephone number and email address, for communications relating to the order.

The personal data provided will be used exclusively for the following purposes:

  • performance of the sales contract, including order management;

  • shipping and delivery of purchased products;

  • management of communications relating to orders;

  • display of order-related information in the website's reserved area, where available.

Where the user has expressly requested it and provided the relevant consent, the data may also be used to send informational newsletters and commercial communications, including offers and promotions.

Providing the data necessary for the performance of the sales contract is mandatory, as it is essential for processing the order, arranging shipment and fulfilling related obligations. Failure to provide such data may prevent the conclusion or performance of the contract.

Providing data for the purpose of sending newsletters and commercial communications is optional, and refusal to provide consent will not affect the user's ability to purchase products or use the website's services.

Security Measures and Data Subject Rights

The website spontaneus.it adopts appropriate technical and organisational measures, in accordance with Article 32 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable best practices, in order to ensure the security and confidentiality of processed personal data and to prevent, as far as reasonably possible, the loss, destruction, disclosure of or unauthorised access to such data.

Under Articles 12 et seq. of the GDPR, data subjects may exercise their rights by contacting the Data Controller using the contact details provided in this Privacy Policy.

In particular, data subjects have the right to:

  • obtain confirmation as to whether or not personal data concerning them exist and, where applicable, access such data and learn about their origin;

  • obtain information about the purposes of processing, the categories of data processed, the recipients or categories of recipients to whom the data may be disclosed, and the envisaged retention period;

  • request the rectification, updating or completion of inaccurate or incomplete personal data;

  • request the erasure of personal data in the cases provided for by Article 17 of the GDPR;

  • request the restriction of processing in the cases provided for by Article 18 of the GDPR;

  • object to the processing of personal data on grounds relating to their particular situation, where provided for by law;

  • object at any time to processing carried out for direct marketing purposes, including profiling related to such purposes;

  • withdraw previously given consent, where processing is based on consent, without affecting the lawfulness of processing carried out before consent was withdrawn;

  • receive the personal data they have provided in a structured, commonly used and machine-readable format, and request the transmission of such data to another Data Controller, in the cases and under the conditions provided for by Article 20 of the GDPR;

  • lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority, pursuant to Article 77 of the GDPR, if they believe that the processing of their personal data infringes applicable legislation.

Data subjects also have the right to know the identifying details of the Data Controller and, where applicable, the individuals or categories of individuals to whom personal data may be disclosed or who may become aware of such data as authorised persons or data processors.

Services Restricted to Adults

The services provided by the website are intended for adults. Minors may use the website's services only with the authorisation and under the supervision of their parents or legal guardians, within the limits established by applicable legislation.

 

PURPOSES OF PROCESSING

Users' personal data are processed for the purposes described below, in compliance with the principles of lawfulness, fairness, transparency and data minimisation, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable legislation.

A) Service Purposes and Compliance with Legal Obligations

Personal data may be processed without the user's express consent where necessary for the performance of a contract, the implementation of pre-contractual measures requested by the data subject, compliance with legal obligations or the pursuit of the Data Controller's legitimate interests, within the limits and under the conditions established by applicable law.

In particular, personal data may be processed to:

  1. manage contractual or pre-contractual requests;

  2. take pre-contractual measures at the user's request;

  3. perform and manage sales contracts, including order and shipping management;

  4. comply with tax, accounting and administrative obligations required by law;

  5. comply with obligations arising from laws, regulations, European Union legislation or orders issued by competent authorities;

  6. produce internal statistics and analyse website usage, where permitted by applicable law;

  7. prevent fraudulent activities, abuse or improper use of the website;

  8. protect the Data Controller's rights and legitimate interests, including in judicial or extrajudicial proceedings;

  9. establish, exercise or defend legal claims;

  10. pursue other purposes connected with the management and security of the website, within the limits established by applicable law.

Personal data may also be processed, where provided for by law, to protect the vital interests of the data subject or another natural person, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, where applicable.

B) Direct Marketing Purposes

Users' personal data may be processed for direct marketing purposes, such as sending informational newsletters, commercial communications, promotional offers and advertising material relating to the Data Controller's products and services, only with the user's prior consent, where required by applicable law.

Consent is freely given and optional. Refusal to provide consent will not affect the user's ability to purchase products or use the website's services.

Users may withdraw their consent at any time, without affecting the lawfulness of processing carried out before withdrawal, by writing to info@spontaneus.it or by using any unsubscribe tools included in the communications received.

 

Payment Management

The website may use external services to manage payments. The data required to complete a transaction may be processed directly by the relevant payment service provider, in accordance with its privacy policy.

  • PayPal Personal Data processed: various types of data, as specified in the service’s privacy policy.

Hosting and Backend Infrastructure

The website and its related technical services may be hosted on infrastructure managed by external providers. These services may involve the processing of technical data necessary for the operation, security and proper delivery of the website.

  • SiteGround Hosting Personal Data processed: cookies, usage data and various types of data as specified in the service’s privacy policy.

Interaction with Social Networks and External Platforms

The website may integrate features, buttons and widgets belonging to social networks or external platforms. Interaction with these tools, and in some cases even their mere display, may involve the processing of Personal Data by the relevant providers.

  • Facebook “Like” button and social widgets Personal Data processed: cookies and usage data.

Any processing of data by Facebook/Meta is carried out in accordance with the procedures described in the privacy policy of the relevant service.

Traffic Optimisation and Distribution

The website may use services designed to manage, optimise and protect website traffic, as well as to improve the performance and security of its web infrastructure.

  • Cloudflare Personal Data processed: cookies and various types of data as specified in the service’s privacy policy.

Cloudflare may process technical data, connection information and data necessary to prevent fraudulent activities, abuse and cybersecurity threats.

Advertising and Conversion Tracking

The website may use advertising tools and conversion-tracking technologies to measure the effectiveness of promotional campaigns, understand users’ interactions with advertisements and improve marketing activities.

These tools may involve the use of cookies and other tracking technologies and, where required by applicable law, are activated only after the user has provided consent through the relevant cookie-management banner.

  • Meta Ads conversion tracking through Meta Pixel Personal Data processed: usage data and tracking tools.

  • Google Ads conversion tracking Personal Data processed: usage data and tracking tools.

  • Google Ad Manager Personal Data processed: usage data and tracking tools.

For further information about the processing of data by the individual providers, users are invited to consult their respective privacy policies.


 

​

 

​

 

 

​

 

Spam Protection

The website may use spam and abuse-protection services designed to distinguish legitimate access and interactions from automated, fraudulent or potentially harmful activities.

These services may collect technical information and data relating to how users interact with the website, including through tracking tools.

  • Google reCAPTCHA Personal Data processed: clicks, usage data, keypress events, motion sensor events, touch events, mouse movements, relative scrolling position, answers to questions and tracking tools.

The processing of data by Google is carried out in accordance with its privacy policy and the applicable service terms.

Remarketing and Behavioural Targeting

The website may use remarketing and behavioural-targeting tools to display more relevant advertising to users who have previously visited the website or interacted with its content.

These tools may allow audience segments to be created or used based on interactions carried out on the website, previous visits or other data made available by advertising platforms.

Where required by applicable law, these tools are activated only after the user has provided consent through the cookie-management banner.

  • Google Ad Manager Audience Extension Personal Data processed: cookies and usage data.

  • Meta Custom Audience Personal Data processed: cookies, email address where provided and processed for this purpose, usage data and tracking tools.

  • Facebook Remarketing and Remarketing with Google Analytics Personal Data processed: usage data and tracking tools.

The use of email addresses to create custom audiences is subject to an appropriate legal basis and, where required, to the specific consent of the data subject. Email addresses must not be used for remarketing purposes unless this processing has been adequately described in the privacy notice and authorised where necessary.

Statistics

The website may use statistical-analysis tools to understand how users navigate the website, improve its content and functionality, monitor performance and assess the effectiveness of communication and marketing activities.

Depending on the configuration used, these tools may process cookies, unique device identifiers, usage data and other technical information. Analytics tools that are not strictly necessary are activated, where required by applicable law, only after the user has provided consent.

  • Google Analytics 4 Personal Data processed: cookies, unique advertising device identifiers, such as Google Advertiser ID or IDFA, and various types of data as specified in the service’s privacy policy.

  • Google Analytics Advertising Reporting Features Personal Data processed: cookies and usage data.

  • Google Analytics User ID Extension Personal Data processed: tracking tools and data associated with the user identifier, where this feature is actually enabled and used.

The activation of advertising features and the User ID extension should be verified in the Google Analytics configuration. In particular, User ID must be used in compliance with the principles of data minimisation, transparency and purpose limitation, avoiding the inclusion of unnecessary directly identifying information.

 

 

 

Display of Content from External Platforms

The website may use services and components provided by external platforms to display content, maps, fonts, icons, videos and other elements embedded in its pages.

The display of such content may involve the processing of technical and usage data by the relevant providers. In some cases, the service may be activated or content may be loaded only after the user has provided consent through the cookie-management banner, where required by applicable law.

  • Google Fonts and Font Awesome Personal Data processed: usage data and tracking tools, where applicable.

  • Google Maps widget Personal Data processed: cookies and usage data.

  • YouTube video widget Personal Data processed: cookies and usage data.

Any processing of data by Google, YouTube or other providers is carried out in accordance with their respective privacy policies.

Where possible, the website may use embedding methods designed to limit data collection before the user interacts with the content. The availability and configuration of these methods should be verified directly in the website settings and in the settings of the relevant services.

 

Online Sale of Goods and Services

Personal Data collected through the website are processed to enable the sale of products and, where applicable, the provision of services to the user, including order management, payment processing and any delivery arrangements.

The data required to complete a payment may include information relating to a payment card, the bank account used for a bank transfer or other payment methods available on the website.

Spontaneus does not necessarily collect all payment-related information. The data processed depend on the payment method selected and on the relevant payment service provider. Where payment is handled by an external provider, such as PayPal or another intermediary, the data may be processed directly by that provider in accordance with its privacy policy.

Personal Data may also be used to:

  • manage and confirm orders;

  • issue tax and accounting documents;

  • organise shipment and delivery;

  • provide assistance relating to purchases;

  • manage returns, refunds or disputes;

  • comply with applicable legal obligations.

The provision of data necessary to manage the order and payment is mandatory in order to conclude the sales contract. Failure to provide such data may prevent the user from completing a purchase or receiving the requested service.

Preference Cookies

Preference cookies allow the website to remember the user’s preferences and certain browsing settings, helping to provide a more consistent and personalised experience.

For example, they may store information relating to language, region, time zone or other settings selected by the user.

These cookies may be stored on the website’s local domain and retained for the period necessary to maintain the selected preferences, according to the actual configuration of the service.

bottom of page